High severity7.5OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-59873
CVE-2026-59873
Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tarnpm | < 7.5.19 | 7.5.19 |
Affected products
57- osv-coords54 versionspkg:apk/chainguard/actions-runnerpkg:apk/chainguard/code-serverpkg:apk/chainguard/gitlab-rails-ce-18.1pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-19.1pkg:apk/chainguard/gitlab-rails-ce-19.2pkg:apk/chainguard/gitlab-rails-ce-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-fips-19.0pkg:apk/chainguard/gitlab-rails-ce-fips-19.1pkg:apk/chainguard/gitlab-rails-ce-fips-19.2pkg:apk/chainguard/graalvm-25-ce-nodejspkg:apk/chainguard/homepagepkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kubeflow-centraldashboardpkg:apk/chainguard/lernapkg:apk/chainguard/npmpkg:apk/chainguard/opensearch-dashboards-2pkg:apk/chainguard/opensearch-dashboards-2-fipspkg:apk/chainguard/prismpkg:apk/chainguard/pulumi-language-nodejspkg:apk/chainguard/safpkg:apk/chainguard/sqlpadpkg:apk/chainguard/wazuh-dashboardpkg:apk/chainguard/wazuh-dashboard-fipspkg:apk/wolfi/code-serverpkg:apk/wolfi/kubeflow-centraldashboardpkg:apk/wolfi/lernapkg:apk/wolfi/npmpkg:apk/wolfi/prismpkg:apk/wolfi/pulumi-language-nodejspkg:apk/wolfi/safpkg:apk/wolfi/sqlpadpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-devel
< 2.336.0-r1+ 53 more
- (no CPE)range: < 2.336.0-r1
- (no CPE)range: < 4.129.0-r1
- (no CPE)range: < 18.1.6-r31
- (no CPE)range: < 19.0.4-r10
- (no CPE)range: < 19.1.2-r8
- (no CPE)range: < 19.2.2-r2
- (no CPE)range: < 18.1.6-r61
- (no CPE)range: < 19.0.4-r7
- (no CPE)range: < 19.1.2-r9
- (no CPE)range: < 19.2.1-r4
- (no CPE)range: < 25.0.4-r2
- (no CPE)range: < 1.13.2-r5
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.2.8-r17
- (no CPE)range: < 9.2.8-r17
- (no CPE)range: < 1.10.0-r25
- (no CPE)range: < 9.0.7-r11
- (no CPE)range: < 12.0.0-r1
- (no CPE)range: < 2.19.6-r4
- (no CPE)range: < 2.19.5-r18
- (no CPE)range: < 5.16.0-r1
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 1.6.0-r3
- (no CPE)range: < 7.5.7-r29
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r4
- (no CPE)range: < 4.129.0-r1
- (no CPE)range: < 1.10.0-r25
- (no CPE)range: < 9.0.7-r11
- (no CPE)range: < 12.0.0-r1
- (no CPE)range: < 5.16.0-r1
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 1.6.0-r3
- (no CPE)range: < 7.5.7-r29
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 3.1.14-2.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:10.9.8-1.22.23.1.4.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.3.module_el9.8.0+286+9023ffdb
Patches
Vulnerability mechanics
References
5- github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3nvdPatchWEB
- github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpwnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-23hp-3jrh-7fpwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59873ghsaADVISORY
- github.com/isaacs/node-tar/releases/tag/v7.5.19nvdRelease NotesWEB
News mentions
1- Node Tar: Four Archive Handling Flaws Patched in Same-Day DisclosureVypr Intelligence · Jul 9, 2026